doos/audit/README.md

# audit

**Scope:** [README](../README.md) · [AGENTS](../AGENTS.md) · [COMPARISON](../COMPARISON.md) · [docs/RESEARCH](../docs/RESEARCH.md)

A fixed, named set of 8 known CVEs relevant to the mechanisms doos uses (user namespaces,
overlayfs, tar extraction, abstract sockets, mount handling), each in its own directory with
the public source, why it matters to doos specifically, and a non-destructive regression check
against `build/doos`. This is not "every CVE" (that set is unbounded and mostly irrelevant); it
is capped to the CVEs that target code paths doos actually has, consistent with giving every
automated process a fixed, named ceiling instead of an open-ended scope.

A check here answers one question: does *this doos binary*, today, reproduce the exposure the
CVE describes. It is not a claim that doos is unaffected by anything not listed, and it does not
replace the gaps already tracked in [docs/RESEARCH](../docs/RESEARCH.md) and
[COMPARISON](../COMPARISON.md) section 6.

## Running it

```
cmake -S . -B build && cmake --build build   # build/doos must exist first
make -C audit test                           # sequential
make -C audit -j8 test                       # concurrent, one job per CVE
make -C audit report                         # runs all, never stops, one line prefix per CVE
make -C audit list                           # names the CVE directories
```

Each check is independent, writes only under its own `mktemp -d`, and cleans up on exit. Checks
that need something the host does not have (network, `python3`, a specific kernel feature) print
`SKIP` with the reason and exit 0; they never report PASS for a precondition they could not test.

## Verdicts

| Verdict | Meaning |
|---|---|
| `PASS` | This doos binary does not reproduce the exposure described by the CVE, under the conditions this check creates. |
| `FAIL` | It does. Treat as a regression; the check prints what it observed. |
| `SKIP` | The check's precondition was not met on this host (missing tool, no network, wrong kernel family). Not a verdict on doos. |

## What is deliberately not here

No kernel memory-corruption exploit code (Dirty Pipe, Dirty COW, the `legacy_parse_param` heap
overflow). Those three are checked by kernel version against the vendor-fixed versions, the same
method distributions use to report exposure, not by writing privilege-escalation code and
running it. Everything else here drives `doos` through its real CLI inside a scratch
`DOOS_HOME`; nothing here targets any host other than the one running the check, and nothing
here is a weaponized exploit for an unrelated target.

## The list

| CVE | Component the bug lives in | What doos has in common |
|---|---|---|
| [CVE-2019-5736](CVE-2019-5736/) | runc (Go) `/proc/self/exe` handling | overlayed host `/usr` must stay read-only from inside |
| [CVE-2024-21626](CVE-2024-21626/) | runc (Go) `fchdir` / fd close ordering | no leaked host fd reachable from the exec'd process |
| [CVE-2020-15257](CVE-2020-15257/) | containerd-shim (Go) UID-only access check | `--net host` shares the host's abstract socket namespace by design |
| [CVE-2022-0185](CVE-2022-0185/) | Linux kernel `fs/fs_context.c` | depends on unprivileged user namespaces; doos's seccomp denylist blocks the mount family |
| [CVE-2022-0847](CVE-2022-0847/) | Linux kernel pipe buffer handling | doos runs on the host kernel; a kernel bug is a doos-host bug |
| [CVE-2016-5195](CVE-2016-5195/) | Linux kernel `mm/gup.c` | doos runs on the host kernel; a kernel bug is a doos-host bug |
| [CVE-2026-17106](CVE-2026-17106/) | moby/go-archive (Go), and tar extractors generally | `doos image add` extracts caller-supplied tarballs the same way |
| [CVE-2021-30465](CVE-2021-30465/) | runc (Go) mount target resolution | `fsutil::mkdirs` follows symlinks the same way `create_directories` does by default |

Back to [README](../README.md), [SPEC](../SPEC.md), [AGENTS](../AGENTS.md), [COMPARISON](../COMPARISON.md).